A signed archive link counts by the link, not by the address it comes from. `actions/checkout` in a job container without git downloads a tarball through the link `GET /repos/{owner}/{repo}/tarball/{ref}` sends it to; counted against the signed-out limit of 30 archive downloads a minute per address, jobs behind one address, as g1t's own machines are, would have used it up between them. A link is made for one commit, for 10 minutes, by a request the API already counts, so it is counted at the token rate instead. The rate limits reference says so. · 4f0f25f · flagon-io/g1t

34	34
35	35		A running job's live log, which its run's page asks for about once a
36	36		second, counts as a page, not as a log download.
	37	+	A signed archive link, the address
	38	+	`GET /repos/{owner}/{repo}/tarball/{ref}` and `/zipball/{ref}` send you to,
	39	+	counts by the link, at the token rate, rather than by address: jobs that
	40	+	share an address, as g1t's own machines do, each download their tarball
	41	+	without using up each other's limit.
37	42
38	43		Agents' sandboxes and workflow jobs report to g1t with their own
39	44		credentials. Those reports are not rate limited.

11	11		secretKey,
12	12		} from "@g1t/contracts/rate-limits";
13	13
14		−	import { gitLimited, heavy, pageLimited, sessionCookie, unlimited, usercontentLimited } from "./front-door-limits.ts";
	14	+	import { archiveLink, gitLimited, heavy, pageLimited, sessionCookie, unlimited, usercontentLimited } from "./front-door-limits.ts";
15	15
16	16		/** A binding that lets `allow` requests through per key, recording each key it was asked. */
17	17		function binding(allow: number): RateLimitBinding & { keys: string[] } {
⋯
202	202		assert.equal(await usercontentLimited(env, request("/avatars/" + "a".repeat(64)), "/avatars/" + "a".repeat(64)), null);
203	203		assert.deepEqual(env.WEB_ANONYMOUS_LIMIT.keys, ["ip:203.0.113.9", "ip:203.0.113.9"]);
204	204		});
	205	+
	206	+	test("a signed archive link is known by its token, and only on an archive", () => {
	207	+	assert.equal(archiveLink("/acme/web/archive/abc.tar.gz", "https://g1t.sh/acme/web/archive/abc.tar.gz?token=t1"), "t1");
	208	+	assert.equal(archiveLink("/acme/web/archive/main.zip", "https://g1t.sh/acme/web/archive/main.zip?token=t2"), "t2");
	209	+	assert.equal(archiveLink("/acme/web/archive/main.zip", "https://g1t.sh/acme/web/archive/main.zip"), null);
	210	+	assert.equal(archiveLink("/acme/web/issues", "https://g1t.sh/acme/web/issues?token=t3"), null);
	211	+	});

61	61		return HEAVY.test(pathname);
62	62		}
63	63
	64	+	/** The signed token of an archive download link (`archive/<ref>.zip\|.tar.gz?token=`), or null. */
	65	+	export function archiveLink(pathname: string, url: string): string \| null {
	66	+	if (!/^\/[^/]+\/[^/]+\/archive\/.+\.(?:zip\|tar\.gz)$/.test(pathname)) return null;
	67	+	try {
	68	+	return new URL(url).searchParams.get("token") \|\| null;
	69	+	} catch {
	70	+	return null;
	71	+	}
	72	+	}
	73	+
64	74		/** The session cookie's value, or null when signed out. */
65	75		export function sessionCookie(cookie: string \| null): string \| null {
66	76		const match = /(?:^\|;\s*)g1t_session=([^;]+)/.exec(cookie ?? "");
⋯
107	117		checks.push(secretKey("token", token).then((key) => checkLimit(env.WEB_TOKEN_LIMIT, key)));
108	118		} else if (session) {
109	119		checks.push(secretKey("session", session).then((key) => checkLimit(env.WEB_SESSION_LIMIT, key)));
	120	+	} else if (archiveLink(pathname, request.url)) {
	121	+	// A signed archive link (`GET /repos/{owner}/{repo}/tarball/{ref}` made
	122	+	// it for one commit, for 10 minutes) counts per link, as a token does:
	123	+	// many jobs behind one address fall back to tarballs at once.
	124	+	checks.push(secretKey("archive", archiveLink(pathname, request.url)!).then((key) => checkLimit(env.WEB_TOKEN_LIMIT, key)));
110	125		} else {
111	126		checks.push(checkLimit(env.WEB_ANONYMOUS_LIMIT, address));
112	127		if (heavy(pathname)) checks.push(checkLimit(env.WEB_HEAVY_LIMIT, address));

flagon-io/g1t